Program Analysis and Cyber Security

1. Noam Rinetzky Slides credit: Tom Ball, Dawson Engler, Roman Manevich, Erik Poll, MoolySagiv, Jean Souyris, EranTromer, AvishaiWool, EranYahav Program Analysis and Cyber Security

2. Software is Everywhere

3. Software is Everywhere

4. Software is Everywhere Unreliable

6. December 31, 2008

7. Zune bug 1 while (days > 365) { 2 if (IsLeapYear(year)) { 3 if (days > 366) { 4 days -= 366; 5 year += 1; 6 } 7 } else { 8 days -= 365; 9 year += 1; 10 } 11 } December 31, 2008

8. Zune bug 1 while (366 > 365) { 2 if (IsLeapYear(2008)) { 3 if (366 > 366) { 4 days -= 366; 5 year += 1; 6 } 7 } else { 8 days -= 365; 9 year += 1; 10 } 11 } December 31, 2008 Suggested solution: wait for tomorrow

9. Therac-25 leads to 3 deaths and 3 injuries Software error exposes patients to radiation overdose (100X of intended dose) 1985 to 1987

10. February 25, 1991

11. Patriot Bug - Rounding Error • Time measured in 1/10 seconds • Binary expansion of 1/10: 0.0001100110011001100110011001100.... • 24-bit register 0.00011001100110011001100 • error of • 0.0000000000000000000000011001100... binary, or ~0.000000095 decimal • After 100 hours of operation error is 0.000000095×100×3600×10=0.34 • A Scud travels at about 1,676 meters per second, and so travels more than half a kilometer in this time Suggested solution: reboot every 10 hours

12. Northeast Blackout 14 August, 2003

13. Toyota recalls 160,000 Prius hybrid vehicles Programming error can activate all warning lights, causing the car to think its engine has failed October 2005

14. Boeing's 787 Vulnerable to Hacker Attack security vulnerability in onboard computer networks could allow passengers to access the plane's control systems January 2008

15. Unreliable Software is Exploitable The Sony PlayStation Network breach: An identity-theft bonanza Massive Sony PlayStation data breach puts about 77 million people at higher risk of fraud (April 2011) RSA hacked, information leaksRSA's corporate network suffered what RSA describes as a successful advanced persistent threat attack, and "certain information" was stolen that can somehow affect the security of SecurIDauthentication (March 2011) Stuxnet Worm Still Out of Control at Iran's Nuclear Sites, Experts Say The Stuxnet worm, named after initials found in its code, is the most sophisticated cyberweapon ever created. (December 2010) Security Advisory for Adobe Flash Player, Adobe Reader and Acrobat This vulnerability could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being exploited in the wild in targeted attacks via a Flash (.swf) file embedded in a Microsoft Excel (.xls) file delivered as an email attachment. (March 2011) RSA tokens may be behind major network security problems at Lockheed Martin Lockheed Martin remote access network, protected by SecurID tokens, has been shut down (May 2011)

16. Percentage of Remotely Exploitable Vulnerabilities (source: IBM X-Force)

17. Buffer Overflow Exploits Memory addresses void foo (char *x) { char buf[2]; strcpy(buf, x); } int main (intargc, char *argv[]) { foo(argv[1]); } ./a.out abracadabra Segmentation fault … Previous frame br Return address da Saved FP ca char* x ra buf[2] ab Stack grows this way

18. Buffer Overflow Exploits intcheck_authentication(char *password) { intauth_flag = 0; char password_buffer[16]; strcpy(password_buffer, password); if(strcmp(password_buffer, ”pass1") == 0)auth_flag= 1; if(strcmp(password_buffer, ”pass2") == 0)auth_flag= 1; return auth_flag; } intmain(intargc, char *argv[]) { if(check_authentication(argv[1])) { printf("\n-=-=-=-=-=-=-=-=-=-=-=-=-=-\n"); printf(" Access Granted.\n"); printf("-=-=-=-=-=-=-=-=-=-=-=-=-=-\n"); } else printf("\nAccess Denied.\n"); } (source: “hacking – the art of exploitation, 2nd Ed”)

19. Input Validation Application evil input 1234567890123456 -=-=-=-=-=-=-=-=-=-=-=-=-=- Access Granted. -=-=-=-=-=-=-=-=-=-=-=-=-=-

20. What can we do about it?

21. What can we do about it? I just want to say LOVE YOU SAN!!soomuch Billy Gates why do you make this possible ? Stop making money and fix your software!! (W32.Blaster.Worm / Lovesan worm) August 13, 2003

22. What can we do about it? • Monitoring • Testing • Static Analysis • Formal Verification Run time Design Time

23. Monitoring (runtime defenses) user space monitored application (Outlook) monitor • StackGuard • ProPolice • PointGuard • Security monitors (ptrace) open(“/etc/passwd”, “r”) OS Kernel

24. Testing • build it; try it on a some inputs • printf (“x == 0 => should not get that!”)

25. Testing • Valgrindmemory errors, race conditions, taint analysis • Simulated CPU • Shadow memory Invalid read of size 4 at 0x40F6BBCC: (within /usr/lib/libpng.so.2.1.0.9) by 0x40F6B804: (within /usr/lib/libpng.so.2.1.0.9) by 0x40B07FF4: read_png_image(QImageIO *) (kernel/qpngio.cpp:326) by 0x40AC751B: QImageIO::read() (kernel/qimage.cpp:3621) Address 0xBFFFF0E0 is not stack'd, malloc'd or free'd

26. Testing • Valgrindmemory errors, race conditions • ParasoftJtest/Insure++ memory errors + visualizer, race conditions, exceptions … • IBM Rational Purify memory errors • IBM PureCoveragedetect untested paths • Daikondynamic invariant detection

27. Testing • Useful and challenging • Random inputs • Guided testing (coverage) • Bug reproducing • But … • Observe some program behaviors • What can you say about other behaviors?

28. Formal verification • Mathematical model of software • : VarZ • = [x0,y1] • Logical specification • { 0 < x } = { ε State | 0 <  (x) } • Machine checked formal proofs { 0 < x ∧ y = x } → { 0 < y } { 0 < y } y:= y+1 { 1< y } { 0 < x } y:= x { 0 < x ∧ y = x } { 0 < x } y:= x ; y:=y+1 { 1 < y } { ? }

29. Formal verification • Mathematical model of software • State = VarInteger • S = [x0,y1] • Logical specification • { 0 < x } = { S ε State | 0 < S(x) } • Machine checked formal proofs { Q’ } → { P’ } { P’ } stmt2 { Q } { P } stmt1 { Q’ } { P } stmt1; stmt2 { Q }

30. L4.verified [Klein+,’09] • Microkernel • IPC, Threads, Scheduling, Memory management • Functional correctness (using Isabelle/HOL) • No null pointer de-references. • No memory leaks. • No buffer overflows. • No unchecked user arguments • … • Kernel/proof co-design • Implementation - 2.5 py (8,700 LOC) • Proof – 20 py (200,000 LOP)

31. What can we do about it? • Monitoring • Testing • Static Analysis • Formal Verification Run time Design Time

32. Static Analysis • Lightweight formal verification • Formalize software behavior in a mathematical model (semantics) • Prove (selected) properties of the mathematical model • Automatically, typically with approximation of the formal semantics

33. Why static analysis? • Some errors are hard to find by testing • arise in unusual circumstances/uncommon execution paths • buffer overruns, unvalidatedinput, exceptions, ... • involve non-determinism • race conditions • Full-blown formal verification too expensive

34. What is Static analysis • Develop theory and tools for program correctness and robustness • Reason statically (at compile time) about the possible runtime behaviors of a program “The algorithmic discovery of properties of a program by inspection of its source text1” -- Manna, Pnueli 1 Does not have to literally be the source text, just means w/o running it

35. Static Analysis x = ? if (x > 0) { y = 42; } else { y = 73; foo(); } assert (y == 42); • Bad news: problem is generally undecidable

36. Static Analysis • Central idea: use approximation Exact set of configurations/ behaviors Over Approximation Under Approximation universe

37. Over Approximation x = ? if (x > 0) { y = 42; } else { y = 73; foo(); } assert (y == 42); • Over approximation: assertion may be violated

38. Precision • Lose precision only when required • Understand where precision is lost main(…) { printf(“assertion may be vioalted\n”); }

39. Example main(inti) { int x=3,y=1; do { y = y + 1; } while(--i > 0) assert 0 < x + y } Determine what states can arise during any execution Challenge: set of states is unbounded

40. Abstract Interpretation [Cousot,’79] main(inti) { int x=3,y=1; do { y = y + 1; } while(--i > 0) assert 0 < x + y } Recipe • Abstraction • Transformers • Exploration Determine what states can arise during any execution Challenge: set of states is unbounded Solution: compute a bounded representation of (a superset) of program states

41. 1) Abstraction main(inti) { int x=3,y=1; do { y = y + 1; } while(--i > 0) assert 0 < x + y } concrete state : VarZ • abstract state #: Var{+, 0, -, ?} …

42. 2) Transformers main(inti) { int x=3,y=1; do { y = y + 1; } while(--i > 0) assert 0 < x + y } concrete transformer y = y + 1 • abstract transformer y = y + 1

43. 3) Exploration main(inti) { int x=3,y=1; do { y = y + 1; } while(--i > 0) assert 0 < x + y } 

44. 3) Exploration’ main(inti) { int x=3,y=1; do { y = y - 2; y = y + 3; } while(--i > 0) assert 0 < x + y; }  False alarms (false positive)

45. Goal: exploring program states badstates reachablestates initialstates

46. Technique: explore abstract states badstates reachablestates initialstates

47. Technique: explore abstract states badstates reachablestates initialstates

48. Technique: explore abstract states badstates reachablestates initialstates

49. Technique: explore abstract states badstates reachablestates initialstates

50. Sound: cover all reachable states badstates reachablestates initialstates